Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects network activity associated with the TELEPUZ malware communicating with public Polygon blockchain RPC nodes. The malware interacts with a specific smart contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E) to resolve its AES-encrypted Command and Control (C2) server address.
This rule monitors for processes, file names, or command lines that contain the string 'telepuz', which is indicative of a specific malware or malicious toolset. It alerts on any occurrence within process image names, process command lines, or file paths.
Detects binaries containing plaintext keyword trigger lists used by a keylogger module to target financial and cryptocurrency-related contexts (banking, wallets, payment services)
Detects Blind Eagle JC-46 toolkit static artifacts: leftover XLoader/FormBook builder tag and variable name in decrypted PowerShell orchestrator stages, leaked CryptoObfuscator PDB path in the Paralell.dll injector, forged NVIDIA version-resource string, and Spanish-language HVNC/browser-clone distraction overlay text in the AsyncRAT payload
This rule monitors process execution events for activity related to known malware families (CryptoLoader, PsStealer, Net.loader, PureRAT) or processes executed from '_MEI' temporary directories. It aggregates events within a 15-minute window per device and user, alerting when two or more distinct processes are identified, which is indicative of malware staging or execution chains.
Detects various stages of the Armored Likho APT campaign using the BusySnake stealer, including lure archive delivery, NSIS droppers, LNK shortcut abuse, PowerShell-based staging, VBScript persistence, scheduled task creation, reverse SSH tunneling, and exfiltration of browser and communication artifacts.
Detects known malicious files from the Stealth Falcon CURP/DlrtyGames delivery chain by SHA256 hash and by embedded reference to sideloaded/staged module filenames
Detects the loader-pool.db PNG-format file used to smuggle encrypted payload modules inside IDAT chunks, reassembled after a sleep-based evasion delay
Detects files associated with the DlrtyGames SFX dropper chain: DlrtyGames.exe dropper, Volt_Droid.exe signed host binary abused for DLL sideloading, and the trojanized discord-rpc.x64.dll dependency
Detects obfuscated PHP code, specifically webshells, that utilize apostrophe-based concatenation (e.g., 'a'.'b'.'c') to break up strings into 1-3 character chunks. This technique is often used to evade signature-based detection.
Detects the execution of the 'encrypter-linux-x86' binary on Linux systems, specifically looking for command-line arguments indicative of file encryption activity (-e or --esxi). This binary name is frequently associated with ransomware targeting virtualized environments.
Detects execution of TuxBot v3 multi-architecture ELF binaries, characterized by architecture-specific suffixes (e.g., tuxbot.x86_64) or the presence of the 'Infected By Akiru' banner in command-line arguments. These indicators serve as proxies for identifying this specific LLM-generated bot agent on disk or during runtime execution.
Detects execution/staging of the GodDamn ransomware encrypter binary encrypter-windows-gui-x86.exe from user profile Downloads or Music folders, or matching the known encrypter hash
Detects the execution of the NoEscape ransomware DISKWRITER component by matching known file hashes associated with the wiper malware.
This YARA rule detects files associated with the Agenda (Qilin) ransomware by searching for specific string patterns within the binary, such as hardcoded ransom note contents, Rust language artifacts, and an onion domain used for command-and-control or negotiation. It also validates the file as a Windows executable.
MAL AMOS yara x
YARA
This YARA rule detects the Amos Stealer malware on macOS by matching a specific Mach-O dylib hash and entitlement hash, which are consistent markers for samples of this information stealer.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
Detects known WinUpdateHelper.dll malicious variants by SHA256 hash, side-loaded to initiate infection across 17 kill chains
This YARA rule detects the presence of the WEBC2-GREENCAT malware family by identifying specific binary patterns (opcodes and function structures) typically associated with this threat.
Detects outbound TCP network traffic originating from internal assets to known hardcoded IP addresses and ports associated with PureRAT and DlrtyGames RAT malware families, indicating active command and control (C2) communication.
Page 64 of 232